Every CVESearch/Get API key

CVE-2021-38505

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will...

6.5 MediumFix available

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.08%Unchanged since Dec 9, 2021
90%50%10%1%

What each source reports

NVD Score used6.5

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Record
CVE-2021-38505
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-668
Updated
2026-11-02
CVE ListNo score

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Record
CVE-2021-38505
Updated
2026-11-02
EUVDEUVD-2021-24957No score

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Record
EUVD-2021-24957
Updated
2026-11-03
GitHub AdvisoriesGHSA-fw34-2587-pprfNo score

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will...

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Record
GHSA-fw34-2587-pprf
Weakness
CWE-668
Updated
2026-11-02
OSVALPINE-CVE-2021-385056.5

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Record
ALPINE-CVE-2021-38505
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVUBUNTU-CVE-2021-385056.5

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to the clipboard to the cloud, and make it available on other computers in certain scenarios. Applications that wish to prevent copied data from being recorded in Cloud History must use specific clipboard formats; and Firefox before versions 94 and ESR 91.3 did not implement them. This could have caused sensitive data to be recorded to a user's Microsoft account. This bug only affects Firefox for Windows 10+ with Cloud Clipboard enabled. Other operating systems are unaffected.. This vulnerability affects Firefox < 94, Thunderbird < 91.3, and Firefox ESR < 91.3.

Record
UBUNTU-CVE-2021-38505
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVopenSUSE-SU-2021:1635-1No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Update to version 91.4 MFSA 2021-54 (bsc#1193485)

  • CVE-2021-43536: URL leakage when navigating while executing asynchronous function

  • CVE-2021-43537: Heap buffer overflow when using structured clone

  • CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both

  • CVE-2021-43539: GC rooting failure when calling wasm instance methods

  • CVE-2021-43541: External protocol handler parameters were unescaped

  • CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

  • CVE-2021-43543: Bypass of CSP sandbox directive when embedding

  • CVE-2021-43545: Denial of Service when using the Location API in a loop

  • CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed

  • CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

  • Update to version 91.3.2

  • CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

  • Update to version 91.3 MFSA 2021-50 (bsc#1192250)

  • CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets

  • CVE-2021-38504: Fixed use-after-free in file picker dialog

  • CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data

  • CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning

  • CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

  • CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing

  • CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain

  • CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS

  • Fixed plain text reformatting regression (bsc#1182863)

  • Update to version 91.2 MFSA 2021-47 (bsc#1191332)

  • CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT

  • CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion

  • CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux

  • CVE-2021-32810: Data race in crossbeam-deque

  • CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1

  • CVE-2021-38496: Use-after-free in MessageTask

  • CVE-2021-38497: Validation message could have been overlaid on another origin

  • CVE-2021-38498: Use-after-free of nsLanguageAtomService object

  • CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

  • Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)

  • CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer

  • CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

  • Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)

  • CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1635-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3745-1No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to Extended Support Release 91.3.0 ESR

  • Fixed: Various stability, functionality, and security fixes

MFSA 2021-49 (bsc#1192250)

  • CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets
  • CVE-2021-38504: Use-after-free in file picker dialog
  • CVE-2021-38505: Windows 10 Cloud Clipboard may have recorded sensitive user data
  • CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode without notification or warning
  • CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports
  • CVE-2021-38508: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
  • CVE-2021-38509: Javascript alert box could have been spoofed onto an arbitrary domain
  • CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac OS
  • MOZ-2021-0008: Use-after-free in HTTP2 Session object
  • MOZ-2021-0007: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
Record
openSUSE-SU-2021:3745-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:4150-1No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Update to version 91.4 MFSA 2021-54 (bsc#1193485)

  • CVE-2021-43536: URL leakage when navigating while executing asynchronous function

  • CVE-2021-43537: Heap buffer overflow when using structured clone

  • CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both

  • CVE-2021-43539: GC rooting failure when calling wasm instance methods

  • CVE-2021-43541: External protocol handler parameters were unescaped

  • CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

  • CVE-2021-43543: Bypass of CSP sandbox directive when embedding

  • CVE-2021-43545: Denial of Service when using the Location API in a loop

  • CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed

  • CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

  • Update to version 91.3.2

  • CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

  • Update to version 91.3 MFSA 2021-50 (bsc#1192250)

  • CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets

  • CVE-2021-38504: Fixed use-after-free in file picker dialog

  • CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data

  • CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning

  • CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

  • CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing

  • CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain

  • CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS

  • Fixed plain text reformatting regression (bsc#1182863)

  • Update to version 91.2 MFSA 2021-47 (bsc#1191332)

  • CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT

  • CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion

  • CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux

  • CVE-2021-32810: Data race in crossbeam-deque

  • CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1

  • CVE-2021-38496: Use-after-free in MessageTask

  • CVE-2021-38497: Validation message could have been overlaid on another origin

  • CVE-2021-38498: Use-after-free of nsLanguageAtomService object

  • CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

  • Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)

  • CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer

  • CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

  • Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)

  • CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

Record
openSUSE-SU-2021:4150-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11607-1No score

MozillaThunderbird-91.3.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11607-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11614-1No score

MozillaFirefox-94.0.1-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-94.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11614-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2021:3651-1No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to Extended Support Release 91.3.0 ESR

  • Fixed: Various stability, functionality, and security fixes

MFSA 2021-49 (bsc#1192250)

  • CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets
  • CVE-2021-38504: Use-after-free in file picker dialog
  • CVE-2021-38505: Windows 10 Cloud Clipboard may have recorded sensitive user data
  • CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode without notification or warning
  • CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports
  • CVE-2021-38508: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
  • CVE-2021-38509: Javascript alert box could have been spoofed onto an arbitrary domain
  • CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac OS
  • MOZ-2021-0008: Use-after-free in HTTP2 Session object
  • MOZ-2021-0007: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
Record
SUSE-SU-2021:3651-1
Updated
2026-11-02
OSVSUSE-SU-2021:3721-1No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to Extended Support Release 91.3.0 ESR

  • Fixed: Various stability, functionality, and security fixes

MFSA 2021-49 (bsc#1192250)

  • CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets
  • CVE-2021-38504: Use-after-free in file picker dialog
  • CVE-2021-38505: Windows 10 Cloud Clipboard may have recorded sensitive user data
  • CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode without notification or warning
  • CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports
  • CVE-2021-38508: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
  • CVE-2021-38509: Javascript alert box could have been spoofed onto an arbitrary domain
  • CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac OS
  • MOZ-2021-0008: Use-after-free in HTTP2 Session object
  • MOZ-2021-0007: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
Record
SUSE-SU-2021:3721-1
Updated
2026-11-02
OSVSUSE-SU-2021:3745-1No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to Extended Support Release 91.3.0 ESR

  • Fixed: Various stability, functionality, and security fixes

MFSA 2021-49 (bsc#1192250)

  • CVE-2021-38503: iframe sandbox rules did not apply to XSLT stylesheets
  • CVE-2021-38504: Use-after-free in file picker dialog
  • CVE-2021-38505: Windows 10 Cloud Clipboard may have recorded sensitive user data
  • CVE-2021-38506: Firefox could be coaxed into going into fullscreen mode without notification or warning
  • CVE-2021-38507: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports
  • CVE-2021-38508: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing
  • CVE-2021-38509: Javascript alert box could have been spoofed onto an arbitrary domain
  • CVE-2021-38510: Download Protections were bypassed by .inetloc files on Mac OS
  • MOZ-2021-0008: Use-after-free in HTTP2 Session object
  • MOZ-2021-0007: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
Record
SUSE-SU-2021:3745-1
Updated
2026-11-02
OSVSUSE-SU-2021:4150-1No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Update to version 91.4 MFSA 2021-54 (bsc#1193485)

  • CVE-2021-43536: URL leakage when navigating while executing asynchronous function

  • CVE-2021-43537: Heap buffer overflow when using structured clone

  • CVE-2021-43538: Missing fullscreen and pointer lock notification when requesting both

  • CVE-2021-43539: GC rooting failure when calling wasm instance methods

  • CVE-2021-43541: External protocol handler parameters were unescaped

  • CVE-2021-43542: XMLHttpRequest error codes could have leaked the existence of an external protocol handler

  • CVE-2021-43543: Bypass of CSP sandbox directive when embedding

  • CVE-2021-43545: Denial of Service when using the Location API in a loop

  • CVE-2021-43546: Cursor spoofing could overlay user interface when native cursor is zoomed

  • CVE-2021-43528: JavaScript unexpectedly enabled for the composition area

  • Update to version 91.3.2

  • CVE-2021-40529: Fixed ElGamal implementation could allow plaintext recovery (bsc#1190244)

  • Update to version 91.3 MFSA 2021-50 (bsc#1192250)

  • CVE-2021-38503: Fixed iframe sandbox rules did not apply to XSLT stylesheets

  • CVE-2021-38504: Fixed use-after-free in file picker dialog

  • CVE-2021-38505: Fixed Windows 10 Cloud Clipboard may have recorded sensitive user data

  • CVE-2021-38506: Fixed Thunderbird could be coaxed into going into fullscreen mode without notification or warning

  • CVE-2021-38507: Fixed opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports

  • CVE-2021-38508: Fixed permission Prompt could be overlaid, resulting in user confusion and potential spoofing

  • CVE-2021-38509: Fixed Javascript alert box could have been spoofed onto an arbitrary domain

  • CVE-2021-38510: Fixed Download Protections were bypassed by .inetloc files on Mac OS

  • Fixed plain text reformatting regression (bsc#1182863)

  • Update to version 91.2 MFSA 2021-47 (bsc#1191332)

  • CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT

  • CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion

  • CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux

  • CVE-2021-32810: Data race in crossbeam-deque

  • CVE-2021-38493: Memory safety bugs fixed in Thunderbird 78.14 and Thunderbird 91.1

  • CVE-2021-38496: Use-after-free in MessageTask

  • CVE-2021-38497: Validation message could have been overlaid on another origin

  • CVE-2021-38498: Use-after-free of nsLanguageAtomService object

  • CVE-2021-38500: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38501: Memory safety bugs fixed in Thunderbird 91.2

  • CVE-2021-38502: Downgrade attack on SMTP STARTTLS connections

  • Update to version 91.1.0 MFSA 2021-41 (bsc#1190269)

  • CVE-2021-38492: Navigating to mk: URL scheme could load Internet Explorer

  • CVE-2021-38495: Memory safety bugs fixed in Thunderbird 91.1

  • Update to version 91.0.1 MFSA 2021-37 (bsc#1189547)

  • CVE-2021-29991: Header Splitting possible with HTTP/3 Responses

Record
SUSE-SU-2021:4150-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.15
before 94.0-r0
94.0-r0
firefox
Alpine:v3.16
before 94.0-r0
94.0-r0
firefox
Alpine:v3.17
before 94.0-r0
94.0-r0
firefox
Alpine:v3.18
before 94.0-r0
94.0-r0
firefox
Alpine:v3.19
before 94.0-r0
94.0-r0
firefox
Alpine:v3.20
before 94.0-r0
94.0-r0
firefox
Alpine:v3.21
before 94.0-r0
94.0-r0
firefox
Alpine:v3.22
before 94.0-r0
94.0-r0
firefox
Alpine:v3.23
before 94.0-r0
94.0-r0
firefox-esr
Alpine:v3.15
before 91.3.0-r0
91.3.0-r0
Show 59 moreShow less
Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.16
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.17
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.18
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.19
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.20
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.21
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.22
before 91.3.0-r0
91.3.0-r0
firefox-esr
Alpine:v3.23
before 91.3.0-r0
91.3.0-r0
librewolf
Alpine:v3.21
before 94.0-r0
94.0-r0
librewolf
Alpine:v3.22
before 94.0-r0
94.0-r0
librewolf
Alpine:v3.23
before 94.0-r0
94.0-r0
librewolf
Alpine:v3.24
before 94.0-r0
94.0-r0
thunderbird
Alpine:v3.16
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.17
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.18
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.19
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.20
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.21
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.22
before 91.3.2-r0
91.3.2-r0
thunderbird
Alpine:v3.23
before 91.3.2-r0
91.3.2-r0
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:Enterprise Storage 6
From an advisory covering 8 CVEs
before 91.3.0-150.6.1
91.3.0-150.6.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:OpenStack Cloud 9
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
before 91.3.0-112.80.2
91.3.0-112.80.2
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 8 CVEs
before 91.3.0-152.6.1
91.3.0-152.6.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
From an advisory covering 8 CVEs
before 91.3.0-152.6.1
91.3.0-152.6.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 33 CVEs
before 91.4.0-8.45.2
91.4.0-8.45.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP3
From an advisory covering 33 CVEs
before 91.4.0-8.45.2
91.4.0-8.45.2
mozjs52
Ubuntu:18.04:LTS
All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
None known
mozjs38
Ubuntu:18.04:LTS
All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
None known
mozjs68
Ubuntu:20.04:LTS
All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
None known
mozjs52
Ubuntu:20.04:LTS
All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
None known
mozjs78
Ubuntu:22.04:LTS
All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
None known
MozillaThunderbird
openSUSE:Leap 15.2
From an advisory covering 33 CVEs
before 91.4.0-lp152.2.52.1
91.4.0-lp152.2.52.1
MozillaFirefox
openSUSE:Leap 15.3
From an advisory covering 8 CVEs
before 91.3.0-152.6.1
91.3.0-152.6.1
MozillaThunderbird
openSUSE:Leap 15.3
From an advisory covering 33 CVEs
before 91.4.0-8.45.2
91.4.0-8.45.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
before 91.3.0-1.1
91.3.0-1.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
before 94.0.1-1.1
94.0.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-38505 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published November 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in firefox 94.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,690 references. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open